Back to Blog

Security Architecture: How SynapseAI Protects Patient Data

•SynapseAI Security Team

Protecting mental health data is an absolute operational requirement for clinical practice. The enactment of India's Digital Personal Data Protection (DPDP) Act of 2023 fundamentally alters how personal health data is processed. Patient transcripts, handwritten notes, and medical histories are classified as "unequivocally high-risk"—meaning mishandling data carries severe consequences, including fines scaling up to ₹250 crore.

SynapseAI is designed around these rules, so psychiatrists can use AI-assisted documentation and keep patient data private.

Regulatory Fundamentals: The DPDP Act

Operating at the intersection of psychology and technology requires navigating rigid legal frameworks designed to protect personal data processing.

DPDP Act (India): The DPDP Act functions on a clear "Data Fiduciary" and "Data Principal" relationship. It mandates that any personal data processing must be bound by clear, specific, and revocable consent. Additionally, it imposes strict requirements on data minimization—collecting only what is strictly necessary—and purpose limitation, meaning data collected for clinical charting cannot be repurposed for marketing or model training.

A note on HIPAA: HIPAA is a US law. SynapseAI serves clinics in India and is not HIPAA-certified. We use the same kinds of safeguards that HIPAA's Security Rule describes, such as access controls and strong sign-in.

Encryption and Access

Our infrastructure relies on defense-in-depth engineering principles:

  1. Data at Rest: Clinical notes, note photos and patient details are encrypted at rest (AES-256) by our database and storage provider, Supabase.
  2. Data in Transit: Every connection between the Synapse web portal and our servers uses TLS (HTTPS) encryption.
  3. Private Storage and AI Processing: Our server sends each note photo to Google Vertex AI, which reads the handwriting and returns a draft. Note photos and reports stay in private storage with the patient record while your clinic subscribes, and they are returned to you if you cancel. We do not use patient data to train AI models.
  4. Clinic-Only Access: Database access rules let only your clinic team open your patients' records. Every account signs in with two-step verification.

Explicit Consent Frameworks

The DPDP Act explicitly outlaws broad, blanket consent models for sensitive health data. Data Fiduciaries must obtain specific, informed, and revocable consent. SynapseAI automates purpose-specific consent acquisition prior to consultation.

Before the consultation begins, the patient gives explicit consent for "clinical documentation generation" from their notes, with a one-time code on WhatsApp or email, or on paper in the clinic. The record of that consent is kept with the patient, because the law requires consent to be specific and documented.

References

  1. The Digital Personal Data Protection Act, 2023 (Act No. 22 of 2023). MeitY PDF.
  2. Health Insurance Portability and Accountability Act of 1996 (HIPAA). U.S. Department of Health & Human Services. Summary of the HIPAA Security Rule.
  3. Advanced Encryption Standard (AES). National Institute of Standards and Technology (NIST) FIPS PUB 197. NIST Publication.
  4. Supabase Security. Supabase Trust Center.